CVE-2026-26194 Gogs: Release tag option injection in release deletion
Attackers can inject git options via release tag names during deletion, potentially leading to code execution in Gogs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-26194?
CVE-2026-26194 is a high-severity command injection vulnerability in gogs, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been patched in version 0.14.2.
Weakness: CWE-88
Which versions are affected by CVE-2026-26194?
3 open source packages ship an affected version, including gogs.io/gogs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gogs.io/gogs Go | All versions | None |
gogs.io/gogs Go | All versions | 0.14.2 |
gogs.io/gogs Go | All versions | 0.14.2 |
Products include Gogs Gogs.
How do I fix CVE-2026-26194?
Upgrade gogs.io/gogs to 0.14.2 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-26194 being exploited?
There is no known exploitation of CVE-2026-26194 in the wild and no public exploit code.
Other vulnerabilities in gogs
Sources
Also known as GHSA-v9vm-r24h-6rqm, GO-2026-4617.